Patrick Williams | 7363086 | 2024-03-01 14:30:19 -0600 | [diff] [blame] | 1 | CVE: CVE-2023-46219 |
| 2 | Upstream-Status: Backport [ https://github.com/curl/curl/commit/73b65e94f3531179de45 ] |
| 3 | Signed-off-by: Lee Chee Yang <chee.yang.lee@intel.com> |
| 4 | |
| 5 | From 73b65e94f3531179de45c6f3c836a610e3d0a846 Mon Sep 17 00:00:00 2001 |
| 6 | From: Daniel Stenberg <daniel@haxx.se> |
| 7 | Date: Thu, 23 Nov 2023 08:23:17 +0100 |
| 8 | Subject: [PATCH] fopen: create short(er) temporary file name |
| 9 | |
| 10 | Only using random letters in the name plus a ".tmp" extension. Not by |
| 11 | appending characters to the final file name. |
| 12 | |
| 13 | Reported-by: Maksymilian Arciemowicz |
| 14 | |
| 15 | Closes #12388 |
| 16 | --- |
| 17 | lib/fopen.c | 65 ++++++++++++++++++++++++++++++++++++++++++++++++----- |
| 18 | 1 file changed, 60 insertions(+), 5 deletions(-) |
| 19 | |
| 20 | diff --git a/lib/fopen.c b/lib/fopen.c |
| 21 | index 75b8a7aa534085..a73ac068ea3016 100644 |
| 22 | --- a/lib/fopen.c |
| 23 | +++ b/lib/fopen.c |
| 24 | @@ -39,6 +39,51 @@ |
| 25 | #include "curl_memory.h" |
| 26 | #include "memdebug.h" |
| 27 | |
| 28 | +/* |
| 29 | + The dirslash() function breaks a null-terminated pathname string into |
| 30 | + directory and filename components then returns the directory component up |
| 31 | + to, *AND INCLUDING*, a final '/'. If there is no directory in the path, |
| 32 | + this instead returns a "" string. |
| 33 | + |
| 34 | + This function returns a pointer to malloc'ed memory. |
| 35 | + |
| 36 | + The input path to this function is expected to have a file name part. |
| 37 | +*/ |
| 38 | + |
| 39 | +#ifdef _WIN32 |
| 40 | +#define PATHSEP "\\" |
| 41 | +#define IS_SEP(x) (((x) == '/') || ((x) == '\\')) |
| 42 | +#elif defined(MSDOS) || defined(__EMX__) || defined(OS2) |
| 43 | +#define PATHSEP "\\" |
| 44 | +#define IS_SEP(x) ((x) == '\\') |
| 45 | +#else |
| 46 | +#define PATHSEP "/" |
| 47 | +#define IS_SEP(x) ((x) == '/') |
| 48 | +#endif |
| 49 | + |
| 50 | +static char *dirslash(const char *path) |
| 51 | +{ |
| 52 | + size_t n; |
| 53 | + struct dynbuf out; |
| 54 | + DEBUGASSERT(path); |
| 55 | + Curl_dyn_init(&out, CURL_MAX_INPUT_LENGTH); |
| 56 | + n = strlen(path); |
| 57 | + if(n) { |
| 58 | + /* find the rightmost path separator, if any */ |
| 59 | + while(n && !IS_SEP(path[n-1])) |
| 60 | + --n; |
| 61 | + /* skip over all the path separators, if any */ |
| 62 | + while(n && IS_SEP(path[n-1])) |
| 63 | + --n; |
| 64 | + } |
| 65 | + if(Curl_dyn_addn(&out, path, n)) |
| 66 | + return NULL; |
| 67 | + /* if there was a directory, append a single trailing slash */ |
| 68 | + if(n && Curl_dyn_addn(&out, PATHSEP, 1)) |
| 69 | + return NULL; |
| 70 | + return Curl_dyn_ptr(&out); |
| 71 | +} |
| 72 | + |
| 73 | /* |
| 74 | * Curl_fopen() opens a file for writing with a temp name, to be renamed |
| 75 | * to the final name when completed. If there is an existing file using this |
| 76 | @@ -50,25 +95,34 @@ CURLcode Curl_fopen(struct Curl_easy *data, const char *filename, |
| 77 | FILE **fh, char **tempname) |
| 78 | { |
| 79 | CURLcode result = CURLE_WRITE_ERROR; |
| 80 | - unsigned char randsuffix[9]; |
| 81 | + unsigned char randbuf[41]; |
| 82 | char *tempstore = NULL; |
| 83 | struct_stat sb; |
| 84 | int fd = -1; |
| 85 | + char *dir; |
| 86 | *tempname = NULL; |
| 87 | |
| 88 | + dir = dirslash(filename); |
| 89 | + if(!dir) |
| 90 | + goto fail; |
| 91 | + |
| 92 | *fh = fopen(filename, FOPEN_WRITETEXT); |
| 93 | if(!*fh) |
| 94 | goto fail; |
| 95 | - if(fstat(fileno(*fh), &sb) == -1 || !S_ISREG(sb.st_mode)) |
| 96 | + if(fstat(fileno(*fh), &sb) == -1 || !S_ISREG(sb.st_mode)) { |
| 97 | + free(dir); |
| 98 | return CURLE_OK; |
| 99 | + } |
| 100 | fclose(*fh); |
| 101 | *fh = NULL; |
| 102 | |
| 103 | - result = Curl_rand_alnum(data, randsuffix, sizeof(randsuffix)); |
| 104 | + result = Curl_rand_alnum(data, randbuf, sizeof(randbuf)); |
| 105 | if(result) |
| 106 | goto fail; |
| 107 | |
| 108 | - tempstore = aprintf("%s.%s.tmp", filename, randsuffix); |
| 109 | + /* The temp file name should not end up too long for the target file |
| 110 | + system */ |
| 111 | + tempstore = aprintf("%s%s.tmp", dir, randbuf); |
| 112 | if(!tempstore) { |
| 113 | result = CURLE_OUT_OF_MEMORY; |
| 114 | goto fail; |
| 115 | @@ -95,6 +149,7 @@ CURLcode Curl_fopen(struct Curl_easy *data, const char *filename, |
| 116 | if(!*fh) |
| 117 | goto fail; |
| 118 | |
| 119 | + free(dir); |
| 120 | *tempname = tempstore; |
| 121 | return CURLE_OK; |
| 122 | |
| 123 | @@ -105,7 +160,7 @@ CURLcode Curl_fopen(struct Curl_easy *data, const char *filename, |
| 124 | } |
| 125 | |
| 126 | free(tempstore); |
| 127 | - |
| 128 | + free(dir); |
| 129 | return result; |
| 130 | } |
| 131 | |